CVE-2023-0482: Insecure Temporary File in RESTEasy
Summary
CVE-2023-0482: Duplicate Advisory: Insecure Temporary File in RESTEasy. Affects org.jboss.resteasy:resteasy-core across 3 version ranges.
< 4.7.8.Final
>= 5.0.0.Alpha1, < 5.0.6.Final
>= 6.0.0.Beta1, < 6.2.3.Final
Fixed in 4.7.8.Final, 5.0.6.Final or 6.2.3.Final, depending on the release line you run. How to fix ↓
Also tracked for
- resteasy3.0 · Debian:11
The same CVE-2023-0482 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.jboss.resteasy:resteasy-undertow, which is part of the Maven ecosystem. RESTEasy is a JAX-RS implementation that provides a framework for building RESTful web services in Java. The resteasy-undertow package specifically integrates RESTEasy with the Undertow web server. Undertow is a lightweight, high-performance web server written in Java. This vulnerability affects versions 0 to 6.2.2.Final of the resteasy-undertow package.
Vulnerability Detail
The vulnerability in RESTEasy involves the insecure usage of File.createTempFile() in the DataSourceProvider, FileProvider, and Mime4JWorkaround classes. These classes create temporary files with insecure permissions, making them readable by a local user. This vulnerability has a CVSS v3 score of 5.5, indicating a moderate severity. The CWE ID associated with this vulnerability is CWE-378. Exploiting this vulnerability could allow an attacker with local access to read sensitive information from these temporary files.
How To Fix
Latest published version: 7.0.5.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.7.8.Final4.7.8.Final -
>= 5.0.0.Alpha1, < 5.0.6.Final5.0.6.Final -
>= 6.0.0.Beta1, < 6.2.3.Final6.2.3.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the fix by updating the package to a secure version.
Conclusion
In conclusion, the RESTEasy package, specifically the resteasy-undertow package, is vulnerable to an insecure temporary file issue. This vulnerability could allow a local user to read sensitive information from temporary files. To fix this vulnerability, it is recommended to update the package to a secure version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.jboss.resteasy:resteasy-core →
FAQ
RESTEasy is a JAX-RS implementation that provides a framework for building RESTful web services in Java.
The resteasy-undertow package integrates RESTEasy with the Undertow web server, allowing developers to use RESTEasy with Undertow.
File.createTempFile() is a method in Java that creates a new temporary file with a unique name in a specified directory. However, in this vulnerability, it is used insecurely, resulting in temporary files with insecure permissions.
Exploiting this vulnerability could allow a local user to read sensitive information from the temporary files created by RESTEasy.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss.resteasy:resteasy-core.
